CVE-2020-12761 — Out-of-bounds Read in Imlib2

CWE-125 — Out-of-bounds ReadCWE-190 — Integer Overflow or Wraparound9 documents7 sources
Severity
9.1CRITICALNVD
EPSS
0.4%
top 37.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Enlightenment Imlib2
Timeline
PublishedMay 9
Latest updateMay 24

Description

modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many colors in its color map.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶Debianenlightenment/imlib2< 1.6.1-2+3

Patches

Patch: git.enlightenment.org ↗Patch: git.enlightenment.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-4fv4-55mw-p3v4: modules/loaders/loader_ico↗2022-05-24
▶
CVEList
CVE-2020-12761: modules/loaders/loader_ico↗2020-05-09
▶
OSV
CVE-2020-12761: modules/loaders/loader_ico↗2020-05-09
▶

📋Vendor Advisories

2
Ubuntu
Imlib2 vulnerability↗2021-10-04
▶
Debian
CVE-2020-12761: imlib2 - modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resul...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-12761 imlib2: integer overflow leading to an out-of-bounds read due to an icon with many colors in its color map [epel-all]↗2020-05-12
▶
Bugzilla
CVE-2020-12761 imlib2: integer overflow leading to an out-of-bounds read due to an icon with many colors in its color map↗2020-05-12
▶
Bugzilla
CVE-2020-12761 imlib2: integer overflow leading to an out-of-bounds read due to an icon with many colors in its color map [fedora-all]↗2020-05-12
▶
CVE-2020-12761 — Out-of-bounds Read in Imlib2 | cvebase